Static task
static1
Behavioral task
behavioral1
Sample
1391df29e6d19d31f650de737ec5f0892060baa4e3364ae0a6fa6c97e12dfbf4.zip
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1391df29e6d19d31f650de737ec5f0892060baa4e3364ae0a6fa6c97e12dfbf4.zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Cointracker Checker/Cointracker Checker/ct checker.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Cointracker Checker/Cointracker Checker/ct checker.exe
Resource
win10v2004-20231222-en
General
-
Target
1391df29e6d19d31f650de737ec5f0892060baa4e3364ae0a6fa6c97e12dfbf4
-
Size
303KB
-
MD5
77a9d50d3ed05cc4560a19ff6f44ef8b
-
SHA1
85e7ca8849786d524d923a7a735d1a048fd4b971
-
SHA256
1391df29e6d19d31f650de737ec5f0892060baa4e3364ae0a6fa6c97e12dfbf4
-
SHA512
d4c73838f24053e29a40db3988a2d38740ab38c599585d77377981d84f2efdb0ccd3d4e0d9541f71ce225f805dd15542e4ecf581f42cfbe49ae82d6bb72060eb
-
SSDEEP
6144:fUNHcnV4exNag0DzegYRQZ+20DOOqUe+ltArbnoCpzpHIq:8He4f7Yu+zrqUeEtUnpNHr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Cointracker Checker/Cointracker Checker/ct checker.exe
Files
-
1391df29e6d19d31f650de737ec5f0892060baa4e3364ae0a6fa6c97e12dfbf4.zip .ps1 polyglot
-
Cointracker Checker/Cointracker Checker/ct checker.exe.exe .ps1 windows:4 windows x86 arch:x86 polyglot
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 300KB - Virtual size: 300KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ